cursedbelt-server 1.0.0

package/src/server/sharing/store.spec.ts

@@ -0,0 +1,408 @@
+/**
+ * The store's contract, against a real in-memory SQLite database.
+ *
+ * White-box by STANDARDS §6a's own exception — "auth/permission checks" are the
+ * named high-risk pure logic that keeps its unit tests. Every assertion here is
+ * about a property a consuming app depends on rather than about a table shape; the
+ * four marked 🔴 are the ones that were mutation-tested (break the code, watch the
+ * test fail) because a permissive bug in this file is invisible until it is a
+ * disclosure.
+ */
+import { Database } from "bun:sqlite";
+import { beforeEach, describe, expect, test } from "bun:test";
+import { resolveAccess } from "cursedbelt-core/sharing/model";
+import { sharedResourceSql } from "./sql";
+import { createShareStore, group, user } from "./store";
+
+let db: Database;
+let ticks: number;
+const store = () =>
+	createShareStore({
+		db,
+		app: "family",
+		// A monotonic clock, so an assertion about ordering is about ordering rather
+		// than about how fast the test machine is.
+		now: () => new Date(Date.UTC(2026, 7, 11, 0, 0, ticks++)).toISOString(),
+	});
+
+beforeEach(() => {
+	db = new Database(":memory:");
+	db.exec("PRAGMA foreign_keys = ON");
+	ticks = 0;
+});
+
+describe("grants", () => {
+	test("a read grant is what the resolver answers, and nothing else is", () => {
+		const shares = store();
+		shares.grant({
+			kind: "person",
+			id: "p1",
+			subject: user("aunt@example.com"),
+			level: "read",
+			grantedBy: "owner@example.com",
+		});
+		expect(shares.accessFor({ kind: "person", id: "p1" }, { subjectId: "aunt@example.com" })).toBe(
+			"read",
+		);
+		// A different record, a different person, and a different app all answer none.
+		expect(shares.accessFor({ kind: "person", id: "p2" }, { subjectId: "aunt@example.com" })).toBe(
+			"none",
+		);
+		expect(shares.accessFor({ kind: "person", id: "p1" }, { subjectId: "cousin@example.com" })).toBe(
+			"none",
+		);
+		expect(shares.accessFor({ kind: "budget", id: "p1" }, { subjectId: "aunt@example.com" })).toBe(
+			"none",
+		);
+	});
+
+	test("an address is normalized on the way in AND on the way to a lookup", () => {
+		const shares = store();
+		shares.grant({
+			kind: "person",
+			id: "p1",
+			subject: user("  Aunt@Example.COM "),
+			level: "read",
+			grantedBy: "owner@example.com",
+		});
+		expect(shares.accessFor({ kind: "person", id: "p1" }, { subjectId: "aunt@example.com" })).toBe(
+			"read",
+		);
+		expect(shares.listForResource({ kind: "person", id: "p1" })[0]?.subject.id).toBe(
+			"aunt@example.com",
+		);
+	});
+
+	test("re-granting is one row, and raising the level is a `regrade` in the trail", () => {
+		const shares = store();
+		const input = {
+			kind: "person",
+			id: "p1",
+			subject: user("aunt@example.com"),
+			grantedBy: "owner@example.com",
+		};
+		shares.grant({ ...input, level: "read" });
+		shares.grant({ ...input, level: "write" });
+		expect(shares.listForResource({ kind: "person", id: "p1" })).toHaveLength(1);
+		expect(shares.accessFor({ kind: "person", id: "p1" }, { subjectId: "aunt@example.com" })).toBe(
+			"write",
+		);
+		const [newest] = shares.events({ kind: "person", id: "p1" });
+		expect(newest?.action).toBe("regrade");
+		expect(newest?.previousLevel).toBe("read");
+		expect(newest?.level).toBe("write");
+	});
+
+	test("🔴 `write` covers a read, and `read` never covers a write", () => {
+		const shares = store();
+		shares.grant({
+			kind: "person",
+			id: "p1",
+			subject: user("aunt@example.com"),
+			level: "read",
+			grantedBy: "owner@example.com",
+		});
+		expect(shares.resourceIdsFor("person", { subjectId: "aunt@example.com" }, "read")).toEqual([
+			"p1",
+		]);
+		expect(shares.resourceIdsFor("person", { subjectId: "aunt@example.com" }, "write")).toEqual([]);
+		shares.grant({
+			kind: "person",
+			id: "p2",
+			subject: user("aunt@example.com"),
+			level: "write",
+			grantedBy: "owner@example.com",
+		});
+		expect(shares.resourceIdsFor("person", { subjectId: "aunt@example.com" }, "read")).toEqual([
+			"p1",
+			"p2",
+		]);
+		expect(shares.resourceIdsFor("person", { subjectId: "aunt@example.com" }, "write")).toEqual([
+			"p2",
+		]);
+	});
+
+	test("the strongest grant wins, whichever way it reaches them", () => {
+		const shares = store();
+		shares.createGroup({ id: "g-family", name: "The family", createdBy: "owner@example.com" });
+		shares.addGroupMember("g-family", "aunt@example.com", "owner@example.com");
+		shares.grant({
+			kind: "person",
+			id: "p1",
+			subject: group("g-family"),
+			level: "write",
+			grantedBy: "owner@example.com",
+		});
+		shares.grant({
+			kind: "person",
+			id: "p1",
+			subject: user("aunt@example.com"),
+			level: "read",
+			grantedBy: "owner@example.com",
+		});
+		expect(shares.accessFor({ kind: "person", id: "p1" }, { subjectId: "aunt@example.com" })).toBe(
+			"write",
+		);
+		// …and the pure rule in `cursedbelt-core/sharing` agrees, which is the point of
+		// having written it twice.
+		expect(
+			resolveAccess(
+				shares.listForResource({ kind: "person", id: "p1" }),
+				{ app: "family", kind: "person", id: "p1" },
+				{ subjectId: "aunt@example.com", groupIds: shares.groupIdsFor("aunt@example.com") },
+			),
+		).toBe("write");
+	});
+});
+
+describe("revocation", () => {
+	test("🔴 revoking removes the access and the audit row SURVIVES it", () => {
+		const shares = store();
+		shares.grant({
+			kind: "person",
+			id: "p1",
+			subject: user("aunt@example.com"),
+			level: "write",
+			grantedBy: "owner@example.com",
+		});
+		expect(shares.revoke({
+			kind: "person",
+			id: "p1",
+			subject: user("aunt@example.com"),
+			revokedBy: "owner@example.com",
+		})).toBe("write");
+		expect(shares.accessFor({ kind: "person", id: "p1" }, { subjectId: "aunt@example.com" })).toBe(
+			"none",
+		);
+		expect(shares.listForResource({ kind: "person", id: "p1" })).toEqual([]);
+		// The whole history is still there — a grant, then its revocation.
+		const trail = shares.events({ kind: "person", id: "p1" });
+		expect(trail.map((event) => event.action)).toEqual(["revoke", "grant"]);
+		expect(trail[0]?.level).toBe("write");
+		expect(trail[0]?.subject.id).toBe("aunt@example.com");
+	});
+
+	test("revoking nothing logs nothing", () => {
+		const shares = store();
+		expect(shares.revoke({
+			kind: "person",
+			id: "p1",
+			subject: user("aunt@example.com"),
+			revokedBy: "owner@example.com",
+		})).toBeNull();
+		expect(shares.events()).toEqual([]);
+	});
+
+	test("🔴 deleting a record revokes every grant on it, so an id cannot be inherited", () => {
+		const shares = store();
+		for (const address of ["aunt@example.com", "cousin@example.com"]) {
+			shares.grant({
+				kind: "person",
+				id: "p1",
+				subject: user(address),
+				level: "read",
+				grantedBy: "owner@example.com",
+			});
+		}
+		expect(shares.revokeResource({ kind: "person", id: "p1" }, "owner@example.com")).toBe(2);
+		expect(shares.accessFor({ kind: "person", id: "p1" }, { subjectId: "aunt@example.com" })).toBe(
+			"none",
+		);
+		expect(shares.events({ kind: "person", id: "p1" }).filter((e) => e.action === "revoke")).toHaveLength(
+			2,
+		);
+	});
+
+	test("offboarding one subject clears every kind at once", () => {
+		const shares = store();
+		shares.grant({
+			kind: "person",
+			id: "p1",
+			subject: user("aunt@example.com"),
+			level: "read",
+			grantedBy: "owner@example.com",
+		});
+		shares.grant({
+			kind: "album",
+			id: "a1",
+			subject: user("aunt@example.com"),
+			level: "write",
+			grantedBy: "owner@example.com",
+		});
+		expect(shares.revokeSubject(user("aunt@example.com"), "owner@example.com")).toBe(2);
+		expect(shares.listForSubject(user("aunt@example.com"))).toEqual([]);
+	});
+});
+
+describe("groups", () => {
+	test("membership is what makes a group grant reach somebody, live", () => {
+		const shares = store();
+		shares.createGroup({ id: "g-family", name: "The family", createdBy: "owner@example.com" });
+		shares.grant({
+			kind: "person",
+			id: "p1",
+			subject: group("g-family"),
+			level: "read",
+			grantedBy: "owner@example.com",
+		});
+		const target = { kind: "person", id: "p1" };
+		expect(shares.accessFor(target, { subjectId: "aunt@example.com" })).toBe("none");
+		shares.addGroupMember("g-family", "aunt@example.com", "owner@example.com");
+		expect(shares.accessFor(target, { subjectId: "aunt@example.com" })).toBe("read");
+		// 🔴 Removing them takes effect on the NEXT read, with nothing to invalidate.
+		shares.removeGroupMember("g-family", "aunt@example.com", "owner@example.com");
+		expect(shares.accessFor(target, { subjectId: "aunt@example.com" })).toBe("none");
+	});
+
+	test("🔴 deleting a group revokes the grants made to it", () => {
+		const shares = store();
+		shares.createGroup({ id: "g-family", name: "The family", createdBy: "owner@example.com" });
+		shares.addGroupMember("g-family", "aunt@example.com", "owner@example.com");
+		shares.grant({
+			kind: "person",
+			id: "p1",
+			subject: group("g-family"),
+			level: "write",
+			grantedBy: "owner@example.com",
+		});
+		shares.deleteGroup("g-family", "owner@example.com");
+		expect(shares.accessFor({ kind: "person", id: "p1" }, { subjectId: "aunt@example.com" })).toBe(
+			"none",
+		);
+		// No grant row is left behind pointing at a group that no longer exists…
+		expect(shares.listForResource({ kind: "person", id: "p1" })).toEqual([]);
+		// …and the membership went with it, by foreign key.
+		expect(shares.listGroupMembers("g-family")).toEqual([]);
+		// …and it is all in the trail.
+		const actions = shares.events().map((event) => event.action);
+		expect(actions).toContain("group.delete");
+		expect(actions).toContain("revoke");
+	});
+});
+
+describe("the SQL fragment", () => {
+	/** The consumer's shape: a real table, filtered by the fragment, counted. */
+	const seedPeople = () => {
+		db.exec("CREATE TABLE people (id TEXT PRIMARY KEY, visibility TEXT NOT NULL)");
+		db.exec(
+			"INSERT INTO people (id, visibility) VALUES ('p1', 'private'), ('p2', 'private'), ('p3', 'family')",
+		);
+	};
+
+	test("filters rows AND counts identically, through a user grant and a group", () => {
+		seedPeople();
+		const shares = store();
+		shares.grant({
+			kind: "person",
+			id: "p1",
+			subject: user("aunt@example.com"),
+			level: "read",
+			grantedBy: "owner@example.com",
+		});
+		shares.createGroup({ id: "g-family", name: "The family", createdBy: "owner@example.com" });
+		shares.addGroupMember("g-family", "aunt@example.com", "owner@example.com");
+		shares.grant({
+			kind: "person",
+			id: "p2",
+			subject: group("g-family"),
+			level: "read",
+			grantedBy: "owner@example.com",
+		});
+
+		const clause = shares.sharedSql({
+			kind: "person",
+			subjectId: "aunt@example.com",
+			column: "people.id",
+		});
+		const where = `visibility = 'family' OR ${clause}`;
+		const rows = db.query(`SELECT id FROM people WHERE ${where} ORDER BY id`).all() as {
+			id: string;
+		}[];
+		expect(rows.map((row) => row.id)).toEqual(["p1", "p2", "p3"]);
+		// The COUNT must agree with the rows — the disclosure `people.ts` warns about.
+		const { n } = db.query(`SELECT COUNT(*) AS n FROM people WHERE ${where}`).get() as { n: number };
+		expect(n).toBe(3);
+	});
+
+	test("🔴 a viewer with no grants sees only what was public, and no identity sees nothing", () => {
+		seedPeople();
+		const shares = store();
+		const forNobody = shares.sharedSql({
+			kind: "person",
+			subjectId: "stranger@example.com",
+			column: "people.id",
+		});
+		expect(
+			(db.query(`SELECT id FROM people WHERE ${forNobody}`).all() as unknown[]).length,
+		).toBe(0);
+		// An empty identity must fail CLOSED — the fragment is `0=1`, not `1=1`.
+		expect(sharedResourceSql({ app: "family", kind: "person", subjectId: "  ", column: "id" })).toBe(
+			"0=1",
+		);
+	});
+
+	test("an apostrophe in an address is an address, not an injection", () => {
+		seedPeople();
+		const shares = store();
+		shares.grant({
+			kind: "person",
+			id: "p1",
+			subject: user("o'brien@example.com"),
+			level: "read",
+			grantedBy: "owner@example.com",
+		});
+		const clause = shares.sharedSql({
+			kind: "person",
+			subjectId: "o'brien@example.com",
+			column: "people.id",
+		});
+		const rows = db.query(`SELECT id FROM people WHERE ${clause}`).all() as { id: string }[];
+		expect(rows.map((row) => row.id)).toEqual(["p1"]);
+	});
+});
+
+describe("the notification hook", () => {
+	test("sees every mutation, and its throw cannot lose the grant", () => {
+		const seen: string[] = [];
+		const shares = createShareStore({
+			db,
+			app: "family",
+			onEvent: (event) => {
+				seen.push(event.action);
+				throw new Error("the mail server is down");
+			},
+		});
+		shares.grant({
+			kind: "person",
+			id: "p1",
+			subject: user("aunt@example.com"),
+			level: "read",
+			grantedBy: "owner@example.com",
+		});
+		shares.revoke({
+			kind: "person",
+			id: "p1",
+			subject: user("aunt@example.com"),
+			revokedBy: "owner@example.com",
+		});
+		expect(seen).toEqual(["grant", "revoke"]);
+		expect(shares.events()).toHaveLength(2);
+	});
+});
+
+describe("re-opening the store", () => {
+	test("is idempotent — the migration runs once and the data survives", () => {
+		const first = store();
+		first.grant({
+			kind: "person",
+			id: "p1",
+			subject: user("aunt@example.com"),
+			level: "read",
+			grantedBy: "owner@example.com",
+		});
+		const second = store();
+		expect(second.accessFor({ kind: "person", id: "p1" }, { subjectId: "aunt@example.com" })).toBe(
+			"read",
+		);
+	});
+});